2回答

• 

  Woodo

  2019-05-09 14:33:09

  public class RolesAuthorizationFilter extends AuthorizationFilter {

      public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws IOException {

  
  

          Subject subject = getSubject(request, response);

          String[] rolesArray = (String[]) mappedValue;

          if (rolesArray == null || rolesArray.length == 0) {

              //no roles specified, so nothing to check - allow access.

              return true;

          }

          Set<String> roles = CollectionUtils.asSet(rolesArray);

          return subject.hasAllRoles(roles);

      }

  }

  
  

  0 0
• 

  zzzzzzz小盆友

  2019-03-06 09:19:04

  rolesOr这个自定义的filter就是实现满足数组参数中的任意一个角色都能通过的，过滤实现的是or的关系。而shiro自带的roles角色过滤是and的关系.

  0 0